vfio-user: vfio_user_get_region_info: prevent buffer overflow
If the vfio-user responds with a value large enough such that adding the header size to it overflows, a smaller buffer would be inadvertently allocated, leading to buffer overflow. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3867 Signed-off-by: Thanos Makatos <thanos.makatos@nutanix.com> Fixes: 667866d66620 ("vfio-user: implement VFIO_USER_DEVICE_GET_REGION_INFO") Reviewed-by: Cédric Le Goater <clg@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260721122643.30985-2-thanos.makatos@nutanix.com Signed-off-by: Cédric Le Goater <clg@redhat.com>
Thanos Makatos committed
Jul 21, 2026 at 12:26 UTC
f6a321c94b21f4c4e65de96078d04bd62df08b23
1 file changed
+10
-1
hw/vfio-user/device.c
+10
-1
@@ -128,12 +128,21 @@ static int vfio_user_get_region_info(VFIOUserProxy *proxy,
128
error_printf("vfio_user_get_region_info argsz too small\n");
129
return -E2BIG;
130
}
131
+
132
+ /*
133
+ * Ensure that size doesn't overflow, otherwise we'll allocate a much
134
+ * smaller buffer than we need.
135
+ */
136
+ if (__builtin_add_overflow(info->argsz, sizeof(VFIOUserHdr), &size)) {
137
+ error_printf("vfio_user_get_region_info argsz too large\n");
138
+ return -E2BIG;
139
+ }
140
+
141
if (fds != NULL && fds->send_fds != 0) {
142
error_printf("vfio_user_get_region_info can't send FDs\n");
143
return -EINVAL;
144
}
145
136
- size = info->argsz + sizeof(VFIOUserHdr);
146
msgp = g_malloc0(size);
147
148
vfio_user_request_msg(&msgp->hdr, VFIO_USER_DEVICE_GET_REGION_INFO,